Claroc Research Finds 35,578 Grok Apps Accessible Without Sign-In

Claroc Research reported on November 10, 2026, that 35,578 of the 37,571 Grok apps still online when tested opened without sign-in, including 24 built by SpaceXSI and X staff. Its GhostShares research found confidential corporate, employee and personal material in the open apps. It says people create the apps by describing them in chat and publish them from the same chat window; a screenshot in the report shows Grok’s Build mode selected.

The remaining 1,993 apps returned HTTP 401 access errors associated with the “Only you” or “Invited users” settings. Claroc identified 43,601 names under grok.me through common subdomain-discovery techniques. Researchers loaded first pages once from the public internet without signing in and reviewed saved copies offline.

Each published app receives its own <name>.grok.me hostname. Requests to resolve that name through the Domain Name System can feed searchable passive-DNS indexes, which collect hostname lookups, so even addresses built from four random words can become searchable after use. Shared links whose random identifier sits in the URL path do not expose that identifier through DNS, although search indexing and link scanners can still reveal it.

What the Open Apps Contained

The staff apps at SpaceXSI, formerly xAI, and X included a confidential enterprise-sales onboarding plan, a territory map covering 594 strategic accounts and their pipeline, and eight X advertising proposals, media plans and decks. One proposal was addressed to a US federal agency and marked confidential. A separate advertiser account board tracked progress toward a $1.6 million sales goal.

Beyond SpaceXSI and X, Claroc identified internal data from 30 organizations: 26 had more than 1,000 employees and six were Fortune 500 companies. Most open apps were games, landing pages and calculators. Claroc estimated that 650 to 800 apps contained private data after using an AI model to flag candidates, manually reviewing flagged pages and checking the model against a random sample.

Manually confirmed examples included a hospital group’s searchable roster of more than 3,500 employees, an intensive-care briefing containing one patient’s labs, imaging and ventilator status, and a fire department’s live shift board listing firefighters’ names and badge numbers. A contractor’s timesheet also exposed 18 employee account records with plaintext passwords, including administrator accounts, in script code downloaded by visitors’ browsers.

Publishing and Sign-In Tests

To examine write access and authorization, Claroc built two apps with made-up data. In its paid account, nothing became public before the builder clicked Publish, but the subsequent access panel preselected “Anyone with the link” alongside the “Invited users” and “Only you” options.

The first test was a contact list with a database and no sign-in. A record added from a signed-out incognito window was visible to the next visitor. For the second, a customer list intended for a four-person sales team, Grok added Google and X sign-in buttons. Its code enrolled whoever signed in as a team member before checking membership, causing that check to pass; an uninvited Google account viewed every customer, changed one record and deleted another.

Those tests separate public readability from write protection. An open app may also allow data changes if it lacks sign-in or verifies identity without verifying team membership, but Claroc demonstrated those write and authorization failures only in its own apps. It did not sign in to, submit forms to, call server functions on or modify anyone else’s app.

The available controls worked when enabled. With “Only you” selected, the first app returned HTTP 401 to a stranger for both its page and data function; unpublishing the second took its address offline within seconds.

Disclosure and SpaceXSI’s Response

Claroc said it notified SpaceXSI on November 8, 2026, about the onboarding plan and an advertising proposal, providing exposure counts, the two test apps and four proposed fixes. It reported the other staff apps on November 9, 2026. At publication, SpaceXSI had answered a reporter’s questions but had not replied directly to the research report. The staff apps were taken down following the report, while other users’ exposed apps remained online.

SpaceXSI told the reporter that apps remain private until creators choose to share them, publishing requires several steps, and employee accounts default to “Only you.” Claroc’s finding concerns the access choice in an ordinary paid account, where “Anyone with the link” was preselected. The staff apps were nevertheless publicly accessible despite the described employee default.

Claroc’s proposed changes were to put shared apps on hard-to-guess paths under a single host, add organization-domain-restricted sharing, default to “Only you” while showing who can open an app before publication, and add warnings for database-backed apps without sign-in, with invite-list generation when a request describes a team.

Claroc began contacting affected organizations itself because SpaceXSI’s response did not say it would notify app owners; three organizations had been emailed by publication. The public report omitted hostnames, app titles and links, and Claroc said saved copies would be deleted after notifications are complete.

The findings widen the security concern beyond URL secrecy: discoverable hostnames made published apps enumerable, and the controlled tests showed that generated sign-in code can fail to enforce team membership even after a visitor authenticates.